Remote authentication method and device for distributed tee applications

Abstract

Embodiments of the present specification provide a remote authentication method and device for distributed TEE applications, wherein in the remote authentication method for distributed TEE applications, a verifier sends an authentication request and receives a report file generated by a first TEE application running in a trusted execution environment (TEE), wherein a plurality of second code hashes of a plurality of second TEE applications are embedded in a program code of the first TEE application, and the report file at least includes a first code hash of the first TEE application. In the case where the first code hash is consistent with an expectation, it is determined that remote authentication of the plurality of second TEE applications is passed.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to the technical field of security, and in particular, to a remote attestation method and device for distributed TEE applications. BACKGROUND

[0002] Remote attestation (also known as remote proof) is the most important means to establish trust in the Trusted Execution Environment (TEE) technical solution. Relative to the invisibility of trusted hardware, remote attestation is the only way in the TEE technology that users can feel trust and make trust visible. Essentially, remote attestation of TEE solves two important problems: 1. Platform trust: through remote attestation, it is proved that trusted programs and sensitive data are indeed running and processing in a trusted execution environment. 2. Code trust: through remote attestation, it is confirmed that the code hash of the trusted program, etc., to ensure that the trusted program itself has not been maliciously tampered with. Only after the trust problem is solved through remote attestation, the verifier can safely hand over its sensitive data to the trusted program for processing, and can ensure that the trusted program processes the data according to the expected logic. SUMMARY

[0003] One or more embodiments of the present specification describe a remote attestation method and device for distributed TEE applications, which can improve the authentication efficiency for distributed TEE applications.

[0004] In a first aspect, a remote attestation method for distributed TEE applications is provided, which is executed by a verifier, and includes:

[0005] sending an attestation request;

[0006] receiving a report file generated by a first TEE application running in a Trusted Execution Environment (TEE), wherein the program code of the first TEE application is embedded with a second code hash of each of a plurality of second TEE applications; and the report file at least includes a first code hash of the first TEE application;

[0007] determining that the remote attestation of the plurality of second TEE applications is passed, if the first code hash is consistent with an expectation.

[0008] In a second aspect, a processing method of a remote attestation request for a TEE application is provided, which is executed by a first TEE application running in a Trusted Execution Environment (TEE), and the program code of the first TEE application is embedded with a second code hash of each of a plurality of second TEE applications; the method includes:

[0009] receiving a report request, which is generated according to an attestation request of a verifier;

[0010] in response to the report request, providing a report file to the verifier, the report file comprising at least a first code hash of the first TEE application, such that the verifier determines whether remote attestation of each second TEE application passes based on the first code hash.

[0011] In a third aspect, a device for remote attestation of distributed TEE applications is provided, configured to be deployed at a verifier, comprising:

[0012] a sending unit configured to send an attestation request;

[0013] a receiving unit configured to receive a report file generated by a first TEE application running in a trusted execution environment (TEE), wherein program code of the first TEE application is embedded with a second code hash of each of a plurality of second TEE applications, and the report file comprises at least a first code hash of the first TEE application;

[0014] a determining unit configured to determine that remote attestation of the plurality of second TEE applications passes if the first code hash is consistent with an expectation.

[0015] In a fourth aspect, a device for processing a remote attestation request of distributed TEE applications is provided, configured to be deployed at a first TEE application running in a trusted execution environment (TEE), wherein program code of the first TEE application is embedded with a second code hash of each of a plurality of second TEE applications, and the device comprises:

[0016] a receiving unit configured to receive a report request generated according to an attestation request of a verifier;

[0017] a sending unit configured to, in response to the report request, provide a report file to the verifier, the report file comprising at least a first code hash of the first TEE application, such that the verifier determines whether remote attestation of each second TEE application passes based on the first code hash.

[0018] In a fifth aspect, a computer-readable storage medium is provided, having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method of the first or second aspect.

[0019] In a sixth aspect, a computing device is provided, comprising a memory having stored therein executable code and a processor, wherein execution of the executable code by the processor implements the method of the first or second aspect.

[0020] The remote authentication method for distributed TEE applications provided by one or more embodiments of the present specification forms a chain between the TEE applications by embedding the code hashes of the second TEE applications to be authenticated into the first TEE application, so that the verifier can determine that each second TEE application is trusted when the first TEE application meets the expectations, i.e. is not maliciously tampered with, when performing remote authentication on the second TEE application, thereby greatly improving the remote authentication efficiency of the distributed TEE applications. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present specification, the drawings required for use in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present specification, and other drawings can be obtained by those skilled in the art without creative labor.

[0022] Figure 1 The schematic diagram of the implementation scenario of an embodiment of the present specification;

[0023] Figure 2 The interaction diagram of the remote authentication method for distributed TEE applications according to an embodiment is shown;

[0024] Figure 3 The request method interaction diagram of the target application according to an embodiment is shown;

[0025] Figure 4 The schematic diagram of the remote authentication device for distributed TEE applications according to an embodiment is shown;

[0026] Figure 5 The schematic diagram of the processing device of the remote authentication request for distributed TEE applications according to an embodiment is shown. DETAILED DESCRIPTION

[0027] The solutions provided by the present specification will be described below in conjunction with the drawings.

[0028] In order to improve data security, privacy data security calculation can be performed based on TEE technology. TEE is a security extension based on CPU hardware, which provides a completely isolated environment from the outside, and the program state and code in the environment are trusted. TEE can act as a black box, and the code and data in TEE cannot be snooped even by the operating system layer, and can only be operated through the pre-defined interface in the code. In terms of efficiency, due to the black box nature of TEE, the operation in TEE is performed on plaintext data, rather than complex cryptography operations in homomorphic encryption, and the calculation process efficiency is almost not lost.

[0029] In the TEE technology, taking the SGX (Software Guard Extension, hereinafter referred to as SGX) technology as an example. The computing node can create an enclave based on the SGX technology as a TEE for executing a specific application. In the computing node, a part of the EPC (Enclave Page Cache) region in the memory can be allocated by using the new processor instruction in the CPU to reside in the above-mentioned enclave. The memory region corresponding to the above-mentioned EPC is encrypted by the internal memory encryption engine MEE (Memory Encryption Engine) of the CPU. The content (code and data in the enclave) in the memory region can only be decrypted in the CPU kernel, and the key for encryption and decryption is generated only when the EPC is started and stored in the CPU. It can be seen that the security boundary of the enclave only contains itself and the CPU. Neither privileged software nor non-privileged software can access the enclave. Even the operating system administrator and the VMM (Virtual Machine Monitor; or called Hypervisor) cannot affect the code and data in the enclave, so it has very high security. Under the premise of the above security guarantee, the CPU can process data in the enclave, which has very high computing efficiency, so as to balance the data security and computing efficiency. In addition, the data entering and exiting the TEE can be encrypted, thereby guaranteeing the security of the privacy data.

[0030] The CPU supporting SGX will have a deployment key (Provisioning Key) and a sealing key (Sealing Key) burned into a fuse register in the CPU before it leaves the factory. The fuse register is a one-time programming register, once the data is burned into it, the fuse is melted, so that the subsequent content in the register can only be read and no longer be written. The manufacturer promises that the key burned into the fuse register is randomly generated; in addition, it also promises that all backups about the burned key will be destroyed once burned, that is, even the manufacturer itself does not know the burned key. The Provisioning Key can represent part of the information in the CPU, such as the CPU code (e.g. 6th generation Core, 7th generation Core, etc.), model (such as desktop, mobile, etc.) and the like. For security considerations, the Provisioning Key is not directly used for encryption, signature and other operations, but a proof key (attestation key) derived from the Provisioning Key is used, so the Provisioning Key plays a deployment role.

[0031] The TEE of the computing node can prove the correctness of the included program code or other data to the challenger through a remote attestation mechanism. Among them, before the challenger initiates remote authentication, the CPU in the computing node can detect whether there is an attestation key. If not, initiate initialization. In the process of initialization, EPI D (Enhanced Privacy Identification) can be generated as an attestation key based on a key generation protocol through interaction with the manufacturer server and according to the generation rule of the Provisioning Key, which is generally used as a private key sk1 in an asymmetric encryption key. The EPI D can be stored in the TEE for subsequent signature. Thus, the manufacturer server can obtain the public key pk1 corresponding to the EPI D through the interaction process. It needs to be specially pointed out that the public key pk1 corresponding to the EPI D will not be disclosed, but only kept by the manufacturer server. Such characteristics are suitable for subsequent authentication by the manufacturer server, also known as the attestation server.

[0032] For example, after the TEE of the computing node is ready with sk1 and pk1, the challenger can initiate a remote attestation process to the TEE, which can include some or all of the following steps.

[0033] Step 1: the challenger initiates a challenge request to the TEE in the computing node, requiring the TEE in the computing node to present a quote to prove the correctness of the program code or other data included in the TEE in the computing node;

[0034] Step 2: after receiving the challenge request, the TEE in the computing node generates a report report, which may include the measurement value of the program code running in the TEE and other security-related state information, such as the hash value hash1 of the program code running in the TEE, and then signs the report using the aforementioned private key sk1 through quoting encryption (QE) to obtain a signature sig1, generates a quote containing the report and sig1, and sends the quote to the challenger;

[0035] Step 3: Since the challenger may not have a public key pk1 corresponding to sk1, after receiving the quote containing the report and sig1, the challenger can send the quote to the authentication server;

[0036] Step 4: the authentication server verifies the signature sig1 in the quote using the public key pk1, and returns the verification result to the challenger, wherein, in order to prevent the verification result from being intercepted or modified by an intermediate, the authentication server can sign the verification result using its own private key to obtain a signature sig2, and send the verification result and its signature sig2 to the challenger together;

[0037] Step 5: after receiving the verification result, if the verification result indicates that sig1 is correct, the challenger verifies the report according to the pre-acquired verification data (such as the measurement value), for example, whether the correct hash value of the program code running in the TEE pre-acquired is consistent with hash1 in the report, and if the report passes the verification, that is, the quote passes the verification, the TEE in the computing node completes the remote quote, and then the challenger can jointly execute a specific transaction with the TEE in the computing node.

[0038] Alternatively, in another implementation, the TEE in the computing node can proactively generate a report report and send it to the authentication server for verification to obtain a verification result verified and signed by the authentication server. Subsequently, the verification result is provided to any challenger to prove the legitimacy of its own identity.

[0039] It should be noted that in the traditional remote attestation scheme, remote authentication is generally only performed for a single Enclave. When remote authentication needs to be performed for multiple Enclaves, for example, in a distributed scenario, multiple applications running in different execution environments TEE (referred to as distributed TEE applications) generally need to be remotely authenticated, and the traditional single-Enclave remote authentication scheme can only be performed multiple times by polling, which greatly affects the authentication efficiency of the distributed TEE applications.

[0040] In order to improve the remote authentication efficiency of the distributed TEE applications, the inventors of the present application propose to embed the code hashes of the multiple second TEE applications to be authenticated into the first TEE application, so as to form a chain between the TEE applications. In this way, when the verifier performs remote authentication on the second TEE applications, it only needs to confirm that the first TEE application meets the expectations, i.e. has not been maliciously tampered with, to determine that each second TEE application is trustworthy, so that it is not necessary to perform remote authentication for each second TEE application one by one, which greatly improves the remote authentication efficiency of the distributed TEE applications.

[0041] The implementation principle of the above scheme is as follows: since the hash algorithm has the following characteristics: different inputs have a high probability of getting different outputs. That is, if any second TEE application is tampered with, the corresponding code hash will change. And since the code hash is embedded in the program code of the first TEE application, the code hash of the first TEE application will not be consistent with the correct code hash. Therefore, remote authentication of the first TEE application can be used to achieve remote authentication of multiple second TEE applications (or target applications).

[0042] Figure 1 An implementation scenario of an embodiment disclosed in the present specification is shown in the following figure. Figure 1 In the figure, the first TEE application refers to a main application or a management application running in a TEE. The program code of the first TEE application embeds the code hashes of multiple second TEE applications. The multiple second TEE applications here can refer to application components of a target application distributed in different TEEs, which are also commonly referred to as trusted application parts. It should be understood that the multiple second TEE applications can jointly provide a complete service to the outside. In addition, the target application can also include a normal application part, which refers to the code of the target application executed in a non-trusted execution environment (also referred to as a normal execution environment), which can be used to forward messages between the verifier and the first TEE application / second TEE application.

[0043] Specifically, when the verifier needs to request remote attestation of the target application, the verifier can send a report request to the first TEE application through the normal application part, so that the first TEE application can generate a report file, which at least includes the first code hash of the first TEE application. After the verifier receives the report file through the normal application part, if it is determined that the first code hash is as expected, it can be determined that the remote attestation of the plurality of second TEE applications is passed, that is, the remote attestation of the target application is passed.

[0044] It should be understood that, Figure 1 Only an exemplary description, in actual application, the plurality of second TEE applications can also be different backups of the target application, that is, each second TEE application provides a complete application service to the outside.

[0045] Figure 2 A remote attestation method for a distributed TEE application according to an embodiment is shown. As Figure 2 shown, the method can include the following steps.

[0046] Step S202, the verifier sends an attestation request.

[0047] The attestation request here can be used to request remote attestation of the target application. The target application can include a plurality of trusted application parts running in different trusted execution environments, which can collectively provide a complete service to the outside. Hereinafter, the plurality of trusted application parts are referred to as a plurality of second TEE applications.

[0048] In addition, the above-mentioned target application can also include a normal application part running in a normal execution environment, which is used for message forwarding.

[0049] In one embodiment, the verifier can send an attestation request for the target application to the first TEE application through the normal application part of the target application. That is, to request the first TEE application to present a certificate to show the correctness of the plurality of second TEE applications.

[0050] The first TEE application here refers to the main application or management application running in the TEE. The program code of the first TEE application is embedded with the code hash of the plurality of second TEE applications.

[0051] Specifically, the verifier sends an attestation request for the target application to the normal application part. In response to the attestation request, the normal application part sends a report request to the first TEE application.

[0052] The first TEE application can generate a report file after receiving the report request. The report file can be the quote described above, i.e., it is generated by signing at least the first code hash of the first TEE application with the private key sk1.

[0053] Of course, in actual applications, the signature content can also include other security-related state information, etc., which is not limited in the specification.

[0054] In step S204, the first TEE application sends the report file to the verifier.

[0055] Of course, when the report file described above is generated by the first TEE application in response to the received report request, the first TEE application can first send the report file to the ordinary application part, and then the ordinary application part forwards the report file to the verifier.

[0056] In step S206, the verifier determines that the remote authentication of the plurality of second TEE applications is passed when the first code hash is as expected.

[0057] After receiving the report file, the verifier can verify the signatures of the first TEE application and the authentication server according to the above steps 3-4. After the signature verification is passed, it can be verified whether the correct hash of the first TEE application obtained in advance is consistent with the first code hash in the report file, that is, it is determined whether the first code hash is as expected. If it is as expected, the report file passes the verification, so that it can be determined that the remote authentication of the first TEE application is passed. At the same time, because the program code of the first TEE application is embedded with the second code hash of each of the plurality of second TEE applications, the remote authentication of the plurality of second TEE applications is passed.

[0058] In summary, the scheme provided by the above embodiment of the specification can embed the code hash of the plurality of second TEE applications to be authenticated into the first TEE application, thereby forming a chain between the TEE applications. This makes the verifier only need to confirm that the first TEE application is as expected, i.e., it has not been tampered with maliciously, to determine that each second TEE application is trusted, so that it is not necessary to remotely authenticate each second TEE application one by one, which greatly improves the remote authentication efficiency of the TEE application.

[0059] After the remote authentication of the plurality of second TEE applications is passed, i.e., the remote authentication of the target application is passed, the verifier (e.g., the client) can request to use the target application, which is described below.

[0060] Figure 3 A request method interaction diagram of a target application according to an embodiment is shown. As shown in FIG. 7, the target application is a second TEE application, and the verifier is a client.Figure 3 As shown, the method can comprise the following steps:

[0061] At step S302, the verifier encrypts the private data to be processed using an encryption key to obtain ciphertext data.

[0062] The encryption key can be obtained by the verifier from a first TEE application. The first TEE application maintains an encryption key and a decryption key shared by a plurality of second TEE applications. In one example, the encryption key and the decryption key are a pair of asymmetric keys.

[0063] In one embodiment, the encryption key can be provided by the first TEE application to the verifier through a report file, i.e. the report file further comprises the encryption key shared by the plurality of second TEE applications.

[0064] At step S304, the verifier provides the ciphertext data to the plurality of second TEE applications.

[0065] Specifically, the verifier sends the ciphertext data to the normal application part, which forwards the ciphertext data to the plurality of second TEE applications.

[0066] At step S306, each second TEE application decrypts the ciphertext data using the decryption key obtained from the first TEE application, and performs target processing on the decryption result.

[0067] In one embodiment, the decryption key is provided by the first TEE application to each second TEE application after passing the internal authentication for each second TEE application.

[0068] In one example, the internal authentication can comprise receiving a report file of each second TEE application, wherein the report file of each second TEE application at least comprises a second code hash of the second TEE application. In addition, it can further comprise other security-related state information. The first TEE application judges whether the second code hash is as expected.

[0069] It should be understood that the report file of the second TEE application can also refer to the quote described above, i.e. it is obtained by signing at least the second code hash of the second TEE application using the private key sk1.

[0070] Further, after receiving the report file of a second TEE application, the first TEE application can also verify the signature of the second TEE application and the authentication server through the above steps 3-4. After the signature verification passes, it can be verified whether the correct hash of the second TEE application obtained in advance is consistent with the second code hash in the report file, that is, whether the second code hash is as expected. If it is as expected, the report file passes the verification, so that it can be determined that the internal authentication of the second TEE application passes.

[0071] It should be noted that since the first TEE application only provides the decryption key to the second TEE application whose internal authentication passes (or is authorized), it can ensure that the decryption key is only used within the chain formed by the TEE applications and will not flow out to insecure programs or systems. That is, only the second TEE application whose internal authentication passes can decrypt the ciphertext data, thereby ensuring the security of the privacy data.

[0072] Further, since each second TEE application can share the encryption and decryption key pair, on the one hand, the key generation cost can be saved, and on the other hand, the verifier only needs to provide one piece of ciphertext data (i.e. encrypted by the shared encryption key) when requesting the target application, without the need to repeatedly provide multiple pieces of ciphertext data (i.e. encrypted by the encryption keys maintained by each second TEE application independently) for each second TEE application, which greatly facilitates the use of the target application by the verifier.

[0073] In summary, the present scheme can provide convenience for the verifier while ensuring the security of the privacy data.

[0074] Corresponding to the above-mentioned remote authentication method for distributed TEE applications, an embodiment of the present specification also provides a remote authentication device for distributed TEE applications, which is arranged at the verifier. As shown in the Figure 4 The device can include:

[0075] The sending unit 402 is configured to send an authentication request.

[0076] The receiving unit 404 is configured to receive a report file generated by a first TEE application running in a trusted execution environment (TEE). The program code of the first TEE application is embedded with a second code hash of each second TEE application. The report file at least includes a first code hash of the first TEE application.

[0077] The determining unit 406 is configured to determine that the remote authentication of the plurality of second TEE applications passes if the first code hash is as expected.

[0078] In some embodiments, the plurality of second TEE applications are trusted application parts of the target application, and the target application further includes a normal application part running in a normal execution environment;

[0079] The sending unit 402 is specifically configured to send, to the normal application part, an authentication request for the target application, so that the normal application part sends a report request to the first TEE application;

[0080] The receiving unit 404 is specifically configured to receive, from the normal application part, the report file.

[0081] In some embodiments, the first TEE application maintains an encryption key and a decryption key shared by the plurality of second TEE applications, and the report file further includes the encryption key; the apparatus further includes:

[0082] The encryption unit 408 is configured to encrypt the private data to be processed by using the encryption key to obtain ciphertext data;

[0083] The sending unit 402 is further configured to provide the ciphertext data to the plurality of second TEE applications, so that each second TEE application decrypts the ciphertext data by using the decryption key obtained from the first TEE application, and performs target processing on the decryption result.

[0084] In some embodiments, the plurality of second TEE applications are trusted application parts of the target application, and the target application further includes a normal application part running in a normal execution environment;

[0085] The sending unit 402 is further specifically configured to:

[0086] Send the ciphertext data to the normal application part, so that the normal application part forwards the ciphertext data to the plurality of second TEE applications.

[0087] The functions of each functional module of the apparatuses in the foregoing embodiments of the present specification can be realized by each step of the foregoing method embodiments, and thus the specific working process of the apparatus provided by one embodiment of the present specification is not repeated here.

[0088] The remote authentication apparatus for the distributed TEE application provided by one embodiment of the present specification can improve the authentication efficiency for the distributed TEE application.

[0089] In addition, one embodiment of the present specification further provides a processing apparatus for a remote authentication request of a distributed TEE application, which is arranged in a first TEE application running in a trusted execution environment TEE, and the program code of the first TEE application is embedded with a second code hash of each second TEE application. As shown in the figure, the apparatus includes: Figure 5

[0090] ​The receiving unit 502 is configured to receive a report request, which is generated according to an authentication request of the verifier.

[0091] The sending unit 504 is configured to provide, in response to the report request, a report file to the verifier, the report file at least including the first code hash of the first TEE application, so that the verifier determines whether the remote authentication of each second TEE application is passed based on the first code hash.

[0092] In some embodiments, the plurality of second TEE applications are trusted application parts of a target application, the target application further including a normal application part running in a normal execution environment;

[0093] The receiving unit 502 is specifically configured to receive, from the normal application part, the report request, which is sent by the normal application part in response to an authentication request for the target application received from the verifier;

[0094] The sending unit 504 is specifically configured to send the report file to the normal application part, so that the normal application part forwards the report file to the verifier.

[0095] In some embodiments, the first TEE application maintains an encryption key and a decryption key shared by the plurality of second TEE applications;

[0096] The sending unit 504 is further configured to provide the decryption key to the plurality of second TEE applications after the internal authentication for the plurality of second TEE applications is passed.

[0097] In some embodiments, the apparatus further includes a judging unit 506;

[0098] The receiving unit 502 is further configured to receive a report file of each of the plurality of second TEE applications, the report file including a second code hash of each of the plurality of second TEE applications respectively;

[0099] The judging unit 506 is configured to judge whether each second code hash is consistent with an expectation.

[0100] The functions of each functional module of the apparatus in the foregoing embodiments of the present specification can be realized by each step of the foregoing method embodiments, and thus the specific working process of the apparatus provided by one embodiment of the present specification is not repeated here.

[0101] The processing apparatus for the remote authentication request of the distributed TEE application provided by one embodiment of the present specification can improve the processing efficiency of the remote authentication request.

[0102] According to another aspect, embodiments also provide a computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method according to any one of the embodiments of the method. Figure 2 or Figure 3The described method.

[0103] According to still another aspect, an embodiment also provides a computing device comprising a memory and a processor, the memory having stored therein executable code that, when executed by the processor, implements a method as Figure 2 or Figure 3 The described method.

[0104] Each of the embodiments described in this specification has different features, not necessarily all disposing of the same advantages. Each embodiment presents a different set of advantages. The embodiments can be used individually or in any combination.

[0105] The steps of a method or algorithm described in connection with the present disclosure can be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module can reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium can be integral to the processor. The processor and the storage medium can reside in an ASIC. Alternatively, the processor and the storage medium can be located in a server, and the server can be located in a cloud. The processor and the storage medium can comprise one or more components of the example devices described herein. The processor can execute software modules stored in a storage medium or according to instructions received from a software module stored in a storage medium.

[0106] Those skilled in the art will appreciate that the functions described in the one or more examples above can be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions can be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media include both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. Storage media can be any available media that can be accessed by a general purpose or special purpose computer. By way of example, and not limitation, such computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or any other form of storage medium.

[0107] The above-described embodiments of the application have several aspects, no single one of which is solely responsible for the application's desirable attributes. Without limiting the scope of this application, several non-limiting examples of aspects of the application are discussed below.

[0108] The above description is further explained with reference to the accompanying drawings in which: specific embodiments of the present specification are described. Other embodiments are within the scope of claims. In some cases, the actions or steps recited in the claims can be performed in a different order and still achieve desirable results. Additionally, the processes depicted in the figures do not necessarily require the particular order shown or sequential order in order to achieve the desired results. In some implementations, multitasking and parallel processing can be advantageous or possible.

[0108] The above description is further explained with reference to the accompanying drawings in which: specific embodiments of the present specification are described. Other embodiments are within the scope of claims. In some cases, the actions or steps recited in the claims can be performed in a different order and still achieve desirable results. Additionally, the processes depicted in the figures do not necessarily require the particular order shown or sequential order in order to achieve the desired results. In some implementations, multitasking and parallel processing can be advantageous or possible.

Claims

1. A method for remote attestation of a distributed TEE application, performed by a verifier, comprising: sending an attestation request; receiving a report file generated by a first TEE application running in a trusted execution environment (TEE), wherein a program code of the first TEE application has embedded therein second code hashes of respective program codes of a plurality of second TEE applications; the report file comprising at least a first code hash of the program code of the first TEE application; determining that remote attestation of the plurality of second TEE applications is passed, if the first code hash is as expected.

2. The method of claim 1, wherein, the plurality of second TEE applications are trusted application parts of a target application, the target application further comprising a normal application part running in a normal execution environment; the sending of the attestation request comprises sending, to the normal application part, an attestation request for the target application, so that the normal application part sends a report request to the first TEE application; the receiving of the report file generated by the first TEE application running in a trusted execution environment (TEE) comprises receiving the report file from the normal application part.

3. The method of claim 1, wherein, the first TEE application maintains an encryption key and a decryption key shared by the plurality of second TEE applications, and the report file further comprises the encryption key; the method further comprises: encrypting, using the encryption key, private data to be processed to obtain ciphertext data; providing the ciphertext data to the plurality of second TEE applications, so that each second TEE application decrypts the ciphertext data using the decryption key obtained from the first TEE application, and performs target processing on the decryption result.

4. The method of claim 3, wherein, the plurality of second TEE applications are trusted application parts of a target application, the target application further comprising a normal application part running in a normal execution environment; the providing of the ciphertext data to the plurality of second TEE applications comprises: sending the ciphertext data to the normal application part, so that the normal application part forwards the ciphertext data to the plurality of second TEE applications. 5.A method for processing of a remote attestation request of a distributed TEE application, performed by a first TEE application running in a trusted execution environment (TEE), wherein a program code of the first TEE application has embedded therein second code hashes of respective program codes of a plurality of second TEE applications; the method comprising: receiving a report request generated according to an attestation request of a verifier; in response to the report request, providing a report file to the verifier, the report file comprising at least a first code hash of the program code of the first TEE application, so that the verifier determines whether remote attestation of each second TEE application is passed based on the first code hash.

6. The method of claim 5, wherein, the plurality of second TEE applications are trusted application parts of a target application, the target application further comprising a normal application part running in a normal execution environment; the receiving of the report request comprises receiving the report request from the normal application part, the report request being sent by the normal application part in response to an attestation request for the target application received from the verifier. The providing of the report file to the verifier comprises: sending the report file to the common application part, and forwarding the report file to the verifier.

7. The method of claim 5, wherein, The first TEE application maintains an encryption key and a decryption key shared by the plurality of second TEE applications, and the method further comprises: After internal authentication of the plurality of second TEE applications is passed, the decryption key is provided to the plurality of second TEE applications.

8. The method of claim 7, wherein, The internal authentication comprises: Receiving a report file of each of the plurality of second TEE applications, wherein each second code hash of each second TEE application is included respectively; Determining whether each second code hash is consistent with an expectation.

9. A remote authentication apparatus for a distributed TEE application, arranged at a verifier, comprising: a sending unit configured to send an authentication request; a receiving unit configured to receive a report file generated by a first TEE application running in a trusted execution environment (TEE), wherein a second code hash of program code of each of a plurality of second TEE applications is embedded in program code of the first TEE application; and the report file at least includes a first code hash of the program code of the first TEE application; a determining unit configured to determine that remote authentication of the plurality of second TEE applications is passed, in a case where the first code hash is consistent with an expectation.

10. The apparatus of claim 9, wherein, The plurality of second TEE applications are trusted application parts of a target application, and the target application further includes a common application part running in a common execution environment; The sending unit is specifically configured to send, to the common application part, an authentication request for the target application, so that the common application part sends a report request to the first TEE application; The receiving unit is specifically configured to receive the report file from the common application part.

11. The apparatus of claim 9, wherein, The first TEE application maintains an encryption key and a decryption key shared by the plurality of second TEE applications, and the report file further includes the encryption key; The apparatus further comprises: an encryption unit configured to encrypt to-be-processed private data by using the encryption key to obtain ciphertext data; The sending unit is further configured to provide the ciphertext data to the plurality of second TEE applications, so that each second TEE application decrypts the ciphertext data by using the decryption key obtained from the first TEE application, and performs target processing on a decryption result.

12. The apparatus of claim 11, wherein, The plurality of second TEE applications are trusted application parts of a target application, and the target application further includes a common application part running in a common execution environment; The sending unit is further specifically configured to: send the ciphertext data to the common application part, so that the common application part forwards the ciphertext data to the plurality of second TEE applications.

13. A processing device for a remote attestation request for a distributed TEE application, provided in a first TEE application running in a Trusted Execution Environment, TEE, the program code of the first TEE application having embedded therein a plurality of second code hashes of respective program codes of a plurality of second TEE applications; The apparatus comprises: a receiving unit configured to receive a report request generated according to an authentication request of a verifier; a sending unit configured to provide a report file to the verifier in response to the report request, wherein the report file at least includes a first code hash of program code of the first TEE application, so that the verifier determines whether remote authentication of each second TEE application is passed based on the first code hash.

14. The apparatus of claim 13, wherein, The second TEE applications are trusted application parts of a target application, the target application further comprising a normal application part running in a normal execution environment; The receiving unit is specifically configured to receive the report request from the normal application part, the report request being sent by the normal application part in response to an authentication request for the target application received from the verifier; The sending unit is specifically configured to send the report file to the normal application part for forwarding to the verifier.

15. The apparatus of claim 13, wherein, The first TEE application maintains an encryption key and a decryption key shared by the second TEE applications; The sending unit is further configured to provide the decryption key to the second TEE applications after internal authentication for the second TEE applications is passed.

16. The apparatus of claim 15, further comprising: A judging unit; The receiving unit is further configured to receive report files of the second TEE applications respectively, each including a second code hash of a corresponding second TEE application; The judging unit is configured to judge whether each second code hash is consistent with an expectation.

17. A computer readable storage medium having stored thereon a computer program, wherein, When the computer program is executed in a computer, the computer is caused to perform the method of any one of claims 1-8.

18. A computing device comprising a memory and a processor, wherein, The memory stores executable code, and the processor executes the executable code to implement the method of any one of claims 1-8.

Images